Postupgrade Security Role adjustment Issue

[Former Member]

Hello There,

I have a query. Need a help.

After upgrade, the roles are getting generated in SU25 step 2c. I have adjusted the role by maintaining new authorization object with the values and turning them to green and then generate the role. However upon cross checking, it's not saving any values and those object were again turned to yellow. Kindly suggest is this an upgrade issue or do I have to do some configuration before adjusting those roles. Any suggestion would be greatly appreciable.

[Bernhard_SAP]

Hello Kailash,

you have to remember the rules of note 113290. Especially if an authorization which you update has the status 'Maintained' it may get replaced/added with a new standard authorization depending on that urles upon next merge of authorizations.

As workaround copy the new standard authoriazation, set the standard authorization to 'inactive(w/o updating it) and only adapt the copy according to your need.

Should stay 'green' then.

good luck,

Bernhard

[Former Member]

Hello Bernhard,

I have gone through the rules and tried the work around suggested by you. It was quite helpful information. However, it is still not getting the same way I was expecting. I will really appreciate if you can throw some more detail on that.

[sdipanjan]

I hope you have already deactivated the Objects with status New and copied that into a new Object instance and changed or maintained the values for the Object in the copied one. Also please check the SU24 settings for the Objects which were changes manually and the the Object were with new values in customer table were not updated in the role while you were in older release.

Please provide more information what you have done so far in the particular step and what you found out.

regards,

Dipanjan

[Former Member]

It might be that someone else is also doing the same "job" at the same time?

However I suspect that you are "just" generating the profiles without opening the roles in expert mode to read the old data and merge with the new.

The role will know that there is a change (particularly if you replaced old transactions with new ones) but latest when you just "take a look" and then backout again. Are you using derived roles? It happens there as well.

Another possibility is that someone used the expert mode or saved the derived roles from the master, but when confronted by the yellow lights they decided to backout without generating.

Yet another is that you imported the menu objects from a SPRO project and some of the transactions no longer exit or were report trees. S_TCODE will be standard and yellow for ever...

These are nice examples why you should build roles based on standard and maintained authorizations from the start, and not give people SAP_ALL in development systems (particularly basis people who only understand SAP_ALL but still click around).

Cheers,

Julius

Edited by: Julius Bussche on Mar 16, 2010 10:59 PM

[Former Member]

I am good now. Here we have one of those rare cases. We need to generate the roles manually in PFCG which have red light. The role should is turning into green. Also the help was from the note 113290. Thank you all for the various supportive suggestion.

Best regards,

Kailash Joshi